Working Party Issues Guidance On EU Cookie Compliance

Author:Mr Mark Prinsley, Sarah Byrt and Oliver Yaros
Profession:Mayer Brown

Keywords: Article 29, Data Protection, Cookie Consent Mechanisms, Europe

The Article 29 Data Protection Working Party (the "Working Party") recently issued guidance which sets out the minimum standards required to obtain consent for cookies throughout Europe. The body, which represents all data protection authorities throughout the European Union, has published this guidance on cookie compliance which, amongst other suggestions, highlights the importance of allowing website users to exercise free choice when accepting cookies, the need to obtain active consent and the requirement for not setting cookie consent mechanisms on an entry page before active usage has occurred.

In its opinion, the Working party has said that:

The website operator must provide precise information which properly states the accurate purpose of the processing. The operator must receive consent before setting the cookies and this consent must be unequivocal. This means that the procedure to seek and give consent must leave no doubt as to the data subject's objective. Valid consent must be an active sign of the user's wishes and needs to be freely given with the data subject exercising a real choice; The consent mechanism for cookies should provide a clear, comprehensive and visible notice on the use of the cookies, at the time and place where the consent is sought e.g. on the entry page. When they access the website, users should be able to access all necessary information about the different types or purposes of cookies being used by the website; Consent must be given before the data processing begins. To achieve compliance between all Member States consent should be sought before cookies are set or read; The website must provide clear information to the users on how they may indicate their consent, most likely on the entry page. Tools to obtain consent may include splash screens, banners, modal dialog boxes and browser settings. The process by which users could signify their consent for cookies would be through a positive action or other active behaviour e.g. by ticking a box or clicking on a link; and The cookie mechanism must provide the user with a real choice regarding cookies on the entry page. They must freely choose between the option to accept all/some cookies or decline all/some cookies. They must maintain...

To continue reading